Quick answers
- Is CVE-2026-54645 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-54645 being exploited in the wild.
- How severe is CVE-2026-54645?
- Medium severity, with a CVSS score of 4.8, published 17 September 2026.
- Which products and versions are affected?
- CubeCart before 6.7.5.
- Is there a fix for CVE-2026-54645?
- A patch was published on 2026-06-08: Fix committed before public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-54645 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-54645?
- Check whether you run CubeCart at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the admin/sources/products.index.inc.php file. The vulnerability exists because the application reads rich-text content (description, description_short, and spec_copy fields) from POST data and applies only a basic regex filter that removes <script> tags but fails to strip event-handler attributes (onclick, onload, etc.), SVG content, or javascript: URI schemes. An authenticated administrator with product-editing rights can store payloads using these bypasses; when the stored content is rendered through Smarty templates on the storefront or admin panel, the JavaScript executes. The fix, deployed in version 6.7.5, implements an allowlist HTML sanitizer that strips unsafe content while preserving legitimate formatting. The vulnerability requires admin authentication and product-edit privileges.
Affected products
- CubeCart CubeCart before 6.7.5
Timeline
- 2026-09-17: disclosed
- 2026-06-08: patched: Fix committed before public disclosure